| Message ID | 20170418211625.10190.52568.stgit@tlendack-t1.amdoffice.net (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
Always have a verb in the Subject to form a "do this" or "do that" sentence to better explain what the patch does: "Subject: [PATCH v5 01/32] x86: Add documentation for AMD Secure Memory Encryption (SME)" On Tue, Apr 18, 2017 at 04:16:25PM -0500, Tom Lendacky wrote: > Create a Documentation entry to describe the AMD Secure Memory > Encryption (SME) feature and add documentation for the mem_encrypt= > kernel parameter. > > Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> > --- > Documentation/admin-guide/kernel-parameters.txt | 11 ++++ > Documentation/x86/amd-memory-encryption.txt | 60 +++++++++++++++++++++++ > 2 files changed, 71 insertions(+) > create mode 100644 Documentation/x86/amd-memory-encryption.txt > > diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt > index 3dd6d5d..84c5787 100644 > --- a/Documentation/admin-guide/kernel-parameters.txt > +++ b/Documentation/admin-guide/kernel-parameters.txt > @@ -2165,6 +2165,17 @@ > memory contents and reserves bad memory > regions that are detected. > > + mem_encrypt= [X86-64] AMD Secure Memory Encryption (SME) control > + Valid arguments: on, off > + Default (depends on kernel configuration option): > + on (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=y) > + off (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=n) > + mem_encrypt=on: Activate SME > + mem_encrypt=off: Do not activate SME > + > + Refer to Documentation/x86/amd-memory-encryption.txt > + for details on when memory encryption can be activated. > + > mem_sleep_default= [SUSPEND] Default system suspend mode: > s2idle - Suspend-To-Idle > shallow - Power-On Suspend or equivalent (if supported) > diff --git a/Documentation/x86/amd-memory-encryption.txt b/Documentation/x86/amd-memory-encryption.txt > new file mode 100644 > index 0000000..0b72ff2 > --- /dev/null > +++ b/Documentation/x86/amd-memory-encryption.txt > @@ -0,0 +1,60 @@ > +Secure Memory Encryption (SME) is a feature found on AMD processors. > + > +SME provides the ability to mark individual pages of memory as encrypted using > +the standard x86 page tables. A page that is marked encrypted will be > +automatically decrypted when read from DRAM and encrypted when written to > +DRAM. SME can therefore be used to protect the contents of DRAM from physical > +attacks on the system. > + > +A page is encrypted when a page table entry has the encryption bit set (see > +below on how to determine its position). The encryption bit can be specified > +in the cr3 register, allowing the PGD table to be encrypted. Each successive I missed that the last time: do you mean here, "The encryption bit can be specified in the %cr3 register allowing for the page table hierarchy itself to be encrypted."? > +level of page tables can also be encrypted. Right, judging by the next sentence, it looks like it. The rest looks and reads really nice to me, so feel free to add: Reviewed-by: Borislav Petkov <bp@suse.de> after addressing those minor nitpicks on your next submission. Thanks.
Borislav Petkov <bp@alien8.de> wrote:
> "Subject: [PATCH v5 01/32] x86: Add documentation for AMD Secure Memory Encryption (SME)"
Or:
x86: Document AMD Secure Memory Encryption (SME) support
David
On 4/19/2017 4:02 AM, Borislav Petkov wrote: > Always have a verb in the Subject to form a "do this" or "do that" > sentence to better explain what the patch does: > > "Subject: [PATCH v5 01/32] x86: Add documentation for AMD Secure Memory Encryption (SME)" Will do. Btw, I tried to update all the subjects and descriptions to be more descriptive but I'm sure there is still room for improvement so keep the comments on them coming. > > On Tue, Apr 18, 2017 at 04:16:25PM -0500, Tom Lendacky wrote: >> Create a Documentation entry to describe the AMD Secure Memory >> Encryption (SME) feature and add documentation for the mem_encrypt= >> kernel parameter. >> >> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> >> --- >> Documentation/admin-guide/kernel-parameters.txt | 11 ++++ >> Documentation/x86/amd-memory-encryption.txt | 60 +++++++++++++++++++++++ >> 2 files changed, 71 insertions(+) >> create mode 100644 Documentation/x86/amd-memory-encryption.txt >> >> diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt >> index 3dd6d5d..84c5787 100644 >> --- a/Documentation/admin-guide/kernel-parameters.txt >> +++ b/Documentation/admin-guide/kernel-parameters.txt >> @@ -2165,6 +2165,17 @@ >> memory contents and reserves bad memory >> regions that are detected. >> >> + mem_encrypt= [X86-64] AMD Secure Memory Encryption (SME) control >> + Valid arguments: on, off >> + Default (depends on kernel configuration option): >> + on (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=y) >> + off (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=n) >> + mem_encrypt=on: Activate SME >> + mem_encrypt=off: Do not activate SME >> + >> + Refer to Documentation/x86/amd-memory-encryption.txt >> + for details on when memory encryption can be activated. >> + >> mem_sleep_default= [SUSPEND] Default system suspend mode: >> s2idle - Suspend-To-Idle >> shallow - Power-On Suspend or equivalent (if supported) >> diff --git a/Documentation/x86/amd-memory-encryption.txt b/Documentation/x86/amd-memory-encryption.txt >> new file mode 100644 >> index 0000000..0b72ff2 >> --- /dev/null >> +++ b/Documentation/x86/amd-memory-encryption.txt >> @@ -0,0 +1,60 @@ >> +Secure Memory Encryption (SME) is a feature found on AMD processors. >> + >> +SME provides the ability to mark individual pages of memory as encrypted using >> +the standard x86 page tables. A page that is marked encrypted will be >> +automatically decrypted when read from DRAM and encrypted when written to >> +DRAM. SME can therefore be used to protect the contents of DRAM from physical >> +attacks on the system. >> + >> +A page is encrypted when a page table entry has the encryption bit set (see >> +below on how to determine its position). The encryption bit can be specified >> +in the cr3 register, allowing the PGD table to be encrypted. Each successive > > I missed that the last time: do you mean here, "The encryption bit can > be specified in the %cr3 register allowing for the page table hierarchy > itself to be encrypted."? > >> +level of page tables can also be encrypted. > > Right, judging by the next sentence, it looks like it. Correct. I like the hierarchy term so I'll add that to the text. Note, just because the bit is set in %cr3 doesn't mean the full hierarchy is encrypted. Each level in the hierarchy needs to have the encryption bit set. So, theoretically, you could have the encryption bit set in %cr3 so that the PGD is encrypted, but not set the encryption bit in the PGD entry for a PUD and so the PUD pointed to by that entry would not be encrypted. Thanks, Tom > > The rest looks and reads really nice to me, so feel free to add: > > Reviewed-by: Borislav Petkov <bp@suse.de> > > after addressing those minor nitpicks on your next submission. > > Thanks. >
On Wed, Apr 19, 2017 at 09:23:47AM -0500, Tom Lendacky wrote: > Btw, I tried to update all the subjects and descriptions to be > more descriptive but I'm sure there is still room for improvement > so keep the comments on them coming. No worries there :) > Note, just because the bit is set in %cr3 doesn't mean the full > hierarchy is encrypted. Each level in the hierarchy needs to have the > encryption bit set. So, theoretically, you could have the encryption > bit set in %cr3 so that the PGD is encrypted, but not set the encryption > bit in the PGD entry for a PUD and so the PUD pointed to by that entry > would not be encrypted. Ha, that is a nice detail I didn't realize. You could add it to the text. Thanks.
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index 3dd6d5d..84c5787 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -2165,6 +2165,17 @@ memory contents and reserves bad memory regions that are detected. + mem_encrypt= [X86-64] AMD Secure Memory Encryption (SME) control + Valid arguments: on, off + Default (depends on kernel configuration option): + on (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=y) + off (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=n) + mem_encrypt=on: Activate SME + mem_encrypt=off: Do not activate SME + + Refer to Documentation/x86/amd-memory-encryption.txt + for details on when memory encryption can be activated. + mem_sleep_default= [SUSPEND] Default system suspend mode: s2idle - Suspend-To-Idle shallow - Power-On Suspend or equivalent (if supported) diff --git a/Documentation/x86/amd-memory-encryption.txt b/Documentation/x86/amd-memory-encryption.txt new file mode 100644 index 0000000..0b72ff2 --- /dev/null +++ b/Documentation/x86/amd-memory-encryption.txt @@ -0,0 +1,60 @@ +Secure Memory Encryption (SME) is a feature found on AMD processors. + +SME provides the ability to mark individual pages of memory as encrypted using +the standard x86 page tables. A page that is marked encrypted will be +automatically decrypted when read from DRAM and encrypted when written to +DRAM. SME can therefore be used to protect the contents of DRAM from physical +attacks on the system. + +A page is encrypted when a page table entry has the encryption bit set (see +below on how to determine its position). The encryption bit can be specified +in the cr3 register, allowing the PGD table to be encrypted. Each successive +level of page tables can also be encrypted. + +Support for SME can be determined through the CPUID instruction. The CPUID +function 0x8000001f reports information related to SME: + + 0x8000001f[eax]: + Bit[0] indicates support for SME + 0x8000001f[ebx]: + Bits[5:0] pagetable bit number used to activate memory + encryption + Bits[11:6] reduction in physical address space, in bits, when + memory encryption is enabled (this only affects + system physical addresses, not guest physical + addresses) + +If support for SME is present, MSR 0xc00100010 (MSR_K8_SYSCFG) can be used to +determine if SME is enabled and/or to enable memory encryption: + + 0xc0010010: + Bit[23] 0 = memory encryption features are disabled + 1 = memory encryption features are enabled + +Linux relies on BIOS to set this bit if BIOS has determined that the reduction +in the physical address space as a result of enabling memory encryption (see +CPUID information above) will not conflict with the address space resource +requirements for the system. If this bit is not set upon Linux startup then +Linux itself will not set it and memory encryption will not be possible. + +The state of SME in the Linux kernel can be documented as follows: + - Supported: + The CPU supports SME (determined through CPUID instruction). + + - Enabled: + Supported and bit 23 of MSR_K8_SYSCFG is set. + + - Active: + Supported, Enabled and the Linux kernel is actively applying + the encryption bit to page table entries (the SME mask in the + kernel is non-zero). + +SME can also be enabled and activated in the BIOS. If SME is enabled and +activated in the BIOS, then all memory accesses will be encrypted and it will +not be necessary to activate the Linux memory encryption support. If the BIOS +merely enables SME (sets bit 23 of the MSR_K8_SYSCFG), then Linux can activate +memory encryption by default (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=y) or +by supplying mem_encrypt=on on the kernel command line. However, if BIOS does +not enable SME, then Linux will not be able to activate memory encryption, even +if configured to do so by default or the mem_encrypt=on command line parameter +is specified.
Create a Documentation entry to describe the AMD Secure Memory Encryption (SME) feature and add documentation for the mem_encrypt= kernel parameter. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> --- Documentation/admin-guide/kernel-parameters.txt | 11 ++++ Documentation/x86/amd-memory-encryption.txt | 60 +++++++++++++++++++++++ 2 files changed, 71 insertions(+) create mode 100644 Documentation/x86/amd-memory-encryption.txt